AWS cli: Clarify RDS DB cluster encryption key type in CLI docs
Summary
Expanded the DBCluster Encrypted field documentation to explain AWS managed/customer managed keys and that AWS owned key encryption still protects data at rest; also bumped CLI version.
Security assessment
Documents encryption-at-rest semantics and reduces misinterpretation of Encrypted=false when an AWS owned key is used; no specific vulnerability or incident is referenced.
Evidence
+>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key.
Diff
diff --git a/cli/latest/reference/rds/restore-db-cluster-from-snapshot.md b/cli/latest/reference/rds/restore-db-cluster-from-snapshot.md index 99e6a91..82ee841 100644 --- a//cli/latest/reference/rds/restore-db-cluster-from-snapshot.md +++ b//cli/latest/reference/rds/restore-db-cluster-from-snapshot.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -1316 +1316,3 @@ DBCluster -> (structure) ->> Indicates whether the DB cluster is encrypted. +>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key. +>> +>> If the DB cluster is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` . @@ -1982 +1984 @@ DBCluster -> (structure) - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) »